Honeypot

摘要： At present,the severe network security situation has put forward high requirements for network security defense technology.In order to automate botnet threat warning,this paper researches the types and characteristics of Botnet.Botnet has special characteristics in attributes such as packets,attack time interval,and packet size.In this paper,the attack data is annotated by means of string recognition and expert screening.The attack features are extracted from the labeled attack data,and then use K-means for cluster analysis.The clustering results show that the same attack data has its unique characteristics,and the automatic identification of network attacks is realized based on these characteristics.At the same time,based on the collection and attribute extraction of Botnet attack data,this paper uses RF,GBM,XGBOOST and other machine learning models to test the warning results,and automatically analyzes the attack by importing attack data.In the early warning analysis results,the accuracy rates of different models are obtained.Through the descriptive values of the three accuracy rates of Accuracy,Precision,and F1_Score,the early warning effect of each model can be comprehensively displayed.Among the five algorithms used in this paper,three have an accuracy rate of over 90%.The three models with the highest accuracy are used in the early warning model.The research shows that cyberattacks can be accurately predicted.When this technology is applied to the protection system,accurate early warning can be given before a network attack is launched.

摘要： The growing interest in Honeypots has resulted in increased research, and consequently, a large number of research surveys and/or reviews. Most Honeypot surveys and/or reviews focus on specific and narrow Honeypot research areas. This study aims at exploring and presenting advances and trends in Honeypot’s research and development areas. To this end, a systematic methodology and meta-review analysis were applied to the selection, evaluation, and qualitative examination of the most influential Honeypot surveys and/or reviews available in scientific bibliographic databases. A total of 188 papers have been evaluated and 22 research papers are found by this study to have a higher impact. The findings of the study suggest that the Honeypot survey and/or review papers of considerable relevance to the research community were mostly published in 2018, by IEEE, in conferences organized in India, and included in the IEEE Xplore database. Also, there have been few qualities Honeypot surveys and/or reviews published after 2018. Furthermore, the study identified 10 classes of vital and emerging themes and/or key topics in Honeypot research. This work contributes to research efforts employing established systematic review and reporting methods in Honeypot research. We have included our meta-review methodology, in order to allow further work in this area aiming at a better understanding of the progression of Honeypot research and advances.

摘要： A smart contract honeypot is a special type of smart contract.This type of contract seems to have obvious vulnerabilities in contract design.If a user transfers a certain amount of funds to the contract,then the user can withdraw the funds in the contract.However,once users try to take advantage of this seemingly obvious vulnerability,they will fall into a real trap.Consequently,the user’s investment in the contract cannot be retrieved.The honeypot induces other accounts to launch funds,which seriously threatens the security of property on the blockchain.Detection methods for honeypots are available.However,studying the manner by which to defend existing honeypots is insufficient to fight against honeypots.The new honeypots that may appear in the future from the perspective of an attacker must also be predicted.Therefore,we propose a type of adversarial honeypot.The code and behavioral features of honeypots are obtained through a comparative analysis of the 158,568 nonhoneypots and 352 honeypots.To build an adversarial honeypot,we try to separately hide these features and make the honeypot bypass the existing detection technology.We construct 18 instances on the basis of the proposed adversarial honeypot and use an open-source honeypot detection tool to detect these instances.The experimental result shows that the proposed honeypot can bypass the detection tool with a 100%ratio.Therefore,this type of honeypot should be given attention,and defensive measures should be proposed as soon as possible.

摘要： The security issues of industrial control systems(ICSs)have become increasingly prevalent.As an important part of ICS security,honeypots and anti-honeypots have become the focus of offensive and defensive confrontation.However,research on ICS honeypots still lacks breakthroughs,and it is difficult to simulate real ICS devices perfectly.In this paper,we studied ICS honeypots to identify and address their weaknesses.First,an intelligent honeypot identification framework is proposed,based on which feature data type requirements and feature data acquisition for honeypot identification is studied.Inspired by vulnerability mining,we propose a feature acquisition approach based on lightweight fuzz testing,which utilizes the differences in error handling between the ICS device and the ICS honeypot.By combining the proposed method with common feature acquisition approaches,the integrated feature data can be obtained.The experimental results show that the feature data acquired is effective for honeypot identification.

摘要： 本文先对Honeypot技术作了简要介绍,重点对数据捕获进行了设计.数据捕获是Honeypot系统中最关键的数据模块.获取攻击者的信息都是来自于数据捕获.为了数据捕获的可靠性,本文采用sebek和libpcap双层数据包捕获.

摘要： 信息安全技术是现代军队信息化建设的重点问题。本文对Honeynet技术在海上技术信息网络安全中的应用进行研究。Honeynet技术具有主动防御、伪装性强、交互性好等特点。结合海上军事信息网络的特点,给出一种基于虚拟机的海上军事Honeynet系统的设计方案与实现方法,该系统使得海上军事信息网络安全能够摆脱对硬件设备及环境的要求,有效提高海上军事网络的防御能力。

摘要： 蜜罐的定义HoneyPot（蜜罐）从字面上理解就是使用欺骗的手段，为猎物创造一个看起来似乎很理想化的环境，让其以为自己很容易就能获得想要的东西，但是结果却适得其反。“蜜”的意思可以理解为“蜂蜜”，而“罐”则可以理解为“一个特定的环境”，其本质就是利用一个诱饵去欺骗猎物。在生活中经常可以看到使用蜜罐原理的事情，例如在捕鼠夹上放置食物来捕鼠等。

摘要： 随着网络入侵事件的增加和黑客攻击水平的提高，网络安全问题日趋严重。为了有效的解决新型的网络安全威胁，本文介绍一个新型网络安全防御系统-虚拟蜜罐。文章首先讲述蜜罐的定义、分类、虚拟蜜罐的结构、路由拓扑，并对其进行测试和总结。

摘要： 主动防御技术是近年来网络安全领域发展中的一种新技术.文章以Honeypot为基础,建立系统模型,重点对数据控制进行了优化设计.数据控制是本系统中最关键的一环,优化设计采用数据重定向功能和数据包抑制设计,既能灵活诱骗攻击者的攻击行为,又能对其攻击活动进行一定的限制,大大降低Honeypot带来的安全风险.

摘要： 主动防御是网络安全领域中的一种新技术，而基于Honeypot的主动防御则是这种新技术的典型代表。文章首先对Honeypot技术作了简单介绍，对其系统模块进行了分析，并对其网络结构进行改进。

摘要： 本文介绍了一种基于Honeypot和朴素贝叶斯分类器的扫描检测方法.其基本思想是部署大量的Honeypot而捕捉可能的网络扫描行为.通过对Honeypot的所有事件进行集中的分析,利用朴素贝叶斯分类器进行分类,从而判定出扫描的行为.实验结果表明,使用这种方法有较好的分类精度,可以检测多类扫描攻击.

摘要： 本文介绍了一种基于Honeypot和朴素贝叶斯分类器的扫描检测方法.其基本思想是部署大量的Honeypot而捕捉可能的网络扫描行为.通过对Honeypot的所有事件进行集中的分析,利用朴素贝叶斯分类器进行分类,从而判定出扫描的行为.实验结果表明,使用这种方法有较好的分类精度,可以检测多类扫描攻击.

摘要： 本文介绍了一种基于Honeypot和朴素贝叶斯分类器的扫描检测方法.其基本思想是部署大量的Honeypot而捕捉可能的网络扫描行为.通过对Honeypot的所有事件进行集中的分析,利用朴素贝叶斯分类器进行分类,从而判定出扫描的行为.实验结果表明,使用这种方法有较好的分类精度,可以检测多类扫描攻击.

摘要： 本文介绍了一种基于Honeypot和朴素贝叶斯分类器的扫描检测方法.其基本思想是部署大量的Honeypot而捕捉可能的网络扫描行为.通过对Honeypot的所有事件进行集中的分析,利用朴素贝叶斯分类器进行分类,从而判定出扫描的行为.实验结果表明,使用这种方法有较好的分类精度,可以检测多类扫描攻击.

摘要： 本文介绍了一种基于Honeypot和朴素贝叶斯分类器的扫描检测方法.其基本思想是部署大量的Honeypot而捕捉可能的网络扫描行为.通过对Honeypot的所有事件进行集中的分析,利用朴素贝叶斯分类器进行分类,从而判定出扫描的行为.实验结果表明,使用这种方法有较好的分类精度,可以检测多类扫描攻击.

摘要： 本文介绍了一种基于Honeypot和朴素贝叶斯分类器的扫描检测方法.其基本思想是部署大量的Honeypot而捕捉可能的网络扫描行为.通过对Honeypot的所有事件进行集中的分析,利用朴素贝叶斯分类器进行分类,从而判定出扫描的行为.实验结果表明,使用这种方法有较好的分类精度,可以检测多类扫描攻击.